Wasmtime up to 2.0.1 sensitive information in resource not removed before reuse

Summaryinfo

A vulnerability has been found in Wasmtime up to 2.0.1 and classified as critical. This affects an unknown function. The manipulation leads to sensitive information in resource not removed before reuse. This vulnerability is traded as CVE-2022-39393. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Wasmtime up to 2.0.1. This issue affects an unknown part. The manipulation with an unknown input leads to a sensitive information in resource not removed before reuse vulnerability. Using CWE to declare the problem leads to CWE-226. The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities. Impacted is confidentiality. The summary by CVE is:

Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2. Other mitigations include disabling the pooling allocator and disabling the `memory-init-cow`.

The weakness was shared 11/11/2022 as GHSA-wh6w-3828-g9qf. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2022-39393 since 09/02/2022. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 2.0.2 eliminates this vulnerability. Applying the patch 2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Wasmtime

Version

• 2.0.0
• 2.0.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion